4

I'm working on a decompilation of a windows PE (with its full debug symbols in a PDB) and I'm using IDA to help with it.

I want to know how I can get a list of all references to a given class member variable. When I press 'X' in a name that is a class member variable in the decompiler window it only shows xrefs to it within the actual function being decompiled. I want to see the references in all of the functions. Is that even possible without coding a script?

underthevoid
  • 305
  • 2
  • 8

2 Answers2

5

The other answer is wrong; it's totally possible (assuming the IDB already has a type for the structure in question, and that type has been applied to arguments/variables in Hex-Rays).

In IDA 7.4 and above (I think; might have been 7.3), right-click the variable and press "Jump to xref globally", as follows:

Jump to xref globally

You'll get a popup with all global x-refs, as follows:

Global cross references

This is based on caching, so the first time you do it, you'll want to right-click and press "refresh" as in the image above (which will take a while for large databases, but is totally worth it -- this is one of my most frequently-used features in Hex-Rays).

Rolf Rolles
  • 9,198
  • 1
  • 23
  • 33
  • Thanks for the answer! Sadly my license expired at 7.1. How feasible would it be to be done through scripting? I don't have much knowledge of IDA scripting. – underthevoid Nov 12 '20 at 06:53
  • 1
    Pretty easy. Derive a class off of ctree_visitor_t, whose visit_expr methods looks for cot_memptr/cot_memref expressions. When such an expression x is found, compare x->type to your desired structure type. If it matches, you've found a place where that structure is used. To find accesses to a specific field, compare x->m against the offset of the field you want. To find this across the database, apply your ctree_visitor_t derivative to all functions in the database. – Rolf Rolles Nov 12 '20 at 07:09
  • Very nice @Rolf Rolles. Do you know of a plugin that already does that? – underthevoid Nov 12 '20 at 08:21
  • I don't. Such a plugin is not necessary, as the functionality is built in in later versions (see discussion above). – Rolf Rolles Nov 12 '20 at 16:13
-1

It's not possible. You have to recover the class instance structure, then pass through all class methods and apply the class structure where it's used. Then you go and see where the class is created and track where all its instances are used and make sure that you found all the access points to the public members of the class. Then you go to the structures window and look at all the xrefs for the member that you need.

Anton Kukoba
  • 1,840
  • 6
  • 13
  • As I have the PE's PDB all the initial stuff you said can be gathered in the PBE. IDA already recognizes the structures and variables everywhere. The problem is just I can't figure out how to get a list with all the code that access a given variable. I think it should be very easy to do that with a script but I just thought it should be a default feature that I just don't know of. – underthevoid Nov 11 '20 at 11:14
  • The class structure must be present in the Structures window, then you go and apply it on the assembler, not the decompiled code. There's a video on how to do that https://www.youtube.com/watch?v=X3xCwNt2ZVY – Anton Kukoba Nov 11 '20 at 11:21